Estimate function length

[wacked]

#include <stdlib.h>#include <assert.h>
#include <stdbool.h>
#include <Windows.h>
#include "udis86.h"
#include "funclen.h"


/**
\brief jmp +X == +X + sizeof(jump type) + eip
*/
static size_t get_jump_offset(ud_t* ud, size_t offsetOfInstr);


/**
\todo add loop & jecx (and possibly more) - though both are probably only used to jump back
and currently is_jump is only called to from functions that don't care about that
*/
static bool is_jump(enum ud_mneomic_code op);


static size_t get_jump_offset(ud_t* ud, size_t offsetOfInstr)
{
	const struct ud_operand* op = NULL;
	for(int i = 0; op = ud_insn_opr(ud, i); i++)
	{
		if(op->type == UD_OP_JIMM)
		{
			return op->lval.sdword + offsetOfInstr + ud_insn_len(ud);
		}
		// all other types are weird jumps, like jumps to a register or to []
	}


	return 0;
}


static bool is_jump(enum ud_mneomic_code op)
{
	return op >= UD_Ijo && op <= UD_Ijmp;
}


static bool is_end_of_function(enum ud_mneomic_code opc, ud_t* ud, size_t furthestJump, size_t instrOffset)
{
	if(opc == UD_Iret && furthestJump <= instrOffset)
		return true;
	else if(opc == UD_Ijmp)
	{
		const struct ud_operand* op = ud_insn_opr(ud, 0);
		if(op->type == UD_OP_MEM || op->type == UD_OP_REG)
			return true;
	}
	// todo: 0xCC ?


	return false;
}


size_t estimate_function_length(void* function)
{
	size_t furthestJump = 0; //! Functions can have multiple return points. The library assumes that if a RET is hit and a jmp/jcc went over it, this RET isn't the last
	unsigned char* p = function;
	size_t funcLen = 0;
	ud_t ud;


	ud_init(&ud);
	ud_set_input_buffer(&ud, function, (size_t)function | (PAGE_BOUNDARY - 1)); // Can't read further than page boundary - there be dragons
	ud_set_pc(&ud, (uint64_t)function);
	ud_set_mode(&ud, 64);
	ud_set_syntax(&ud, UD_SYN_INTEL);


	while(funcLen < MINIMUM_REQUIRED_FUNCTION_LENGTH_LONG_HOOK && !ud_input_end(&ud))
	{
		size_t instrLen = 0,
			offsetOfInstr = funcLen;
		if(!(instrLen = ud_disassemble(&ud)) || ud.error)
			return 0;


		p += instrLen;
		funcLen += instrLen;


		printf("%p %s", ud_insn_off(&ud), ud_insn_asm(&ud));


		enum ud_mneomic_code op = ud_insn_mnemonic(&ud);
		if(is_jump(op))
		{
			size_t off = get_jump_offset(&ud, offsetOfInstr);
			if(off > furthestJump)
				furthestJump = off;
		}


		if(is_end_of_function(op, &ud, furthestJump, offsetOfInstr))
		{
			printf("end of function\n");
			break;
		}


		printf("\n");
	}


	return funcLen;
}

#ifndef FUN_LEN_H
#define FUN_LEN_H


#define MINIMUM_REQUIRED_FUNCTION_LENGTH_LONG_HOOK 16


/**
	\brief Estimates the function size by checking opcodes until 
		* an instruction that signifies the end of the function or
		* MINIMUM_REQUIRED_FUNCTION_LENGTH_LONG_HOOK bytes were found
		If the function has multiple return points estimate_function_length() tries to find the farthest by keeping track of jumps forward
	\return 0 on error
*/
static size_t estimate_function_length(void* function);
#endif

Wie man hoffentlich an den includes merkt braucht es die libudis86.

[Jut4h.tm]

Schöner Post danke!